Starting from this, Right.
So I'll go here.
Interface.
Gigurtu is the one which is pointing up.
Name if his inside security level is 100.
IP address is ten.
11.
Ten.
No shot just to make sure.
11.1 should be able to ping it.
Interface gig.
We see IP.
Army is outside security.
Zero IP Address 151 .3. ten Just like before.
Except.
Go outside.
001 51 .33.3.
Should be able to ping on 51 .34.3.
Oh, yeah.
This is after.
Right?
This is the new one?
Yes.
So I'll go in here.
Interface zero zero.
IP Address 150 .1. 30 4.4.
No.
Shut.
Do think quantity.
1.34.2.
Not able to.
Why?
Because probably the interface which is connected to me is not correct.
So this is F10, not zero zero.
Default interface.
34.3 should be reachable.
Is reachable.
Also along the same lines, I.
What else do I need to do?
0163.1.3. 34 dot a default route so that I can reach.
Days I can reach the essay.
I'll create a loopback ten .4.4.4 and I'll create an Ik v2 ik v2 from this guy to do you remember the
steps?
Like we do.
What was the first thing?
Step one.
Crypto ik v2.
Proposal and you call it anything from then you specify encryption.
Three days.
Authentication.
No, not.
Hash.
No integrity is, let's say MD5 and group two.
You could also be more dynamic with it and specify more than one policies.
But I'll do that on the RSA because this is the client.
Okay.
Then you went to crypto.
I agree to policy.
Where you just said proposal is.
Correct.
What else?
Crypto Ikev2 keyring.
Here is it.
Here is RSA.
The address is 151 .33. ten.
Also along the same way you set pre shared.
Key.
Is.
Right.
Either you can say pre-shared key remote or pre-shared key local, but here I'm just going to use also
you went and said crypto v2 profile.
Toilet Ik Prof.
Match.
Identity.
Remote address is what?
151 .33.1.
Then you also said authentication.
Remote is pre-shared.
Authentication local is also.
Getting.
Locals.
This was the first four steps.
Everything else transforms at crypto map.
The way you apply it is the same.
The only difference was here.
Let's check on the east side.
What do I need to do on the side?
I'll go to the essay.
This is actually our.
I'll go to the crypto.
It is again.
It is ITV2.
Obviously ITV2.
But ITV to what?
There is no proposal.
Instead of having those two extra steps.
Let's just put it into policy number.
The policy again, just like before.
And then you specify your stuff.
Encryption.
Three days.
You could also specify a year as a backup.
Integrity.
Degree.
So you specify MD5 and Sha as the backup group.
215.
As a backup.
Also for the newer versions have newer variations.
Right.
There's also one more thing that you have to take care about here.
It's called pseudo random function.
In ITV2 pseudo random function is used for adding extra security to the exchange rate, but it has to
match your integrity.
Whatever integrity you choose by default, it's.
So this is also sha.
But now I changed my integrity to what MD5.
I need to change my prf also to.
Pseudorandom function.
Right policy is the same.
What else was the next part?
How do you think will be the I'll specify the key ring here.
Can you guess?
Talent group, right?
150 .1.34.4.
Type IPsec L2 L.
Tunnel Group again.
150 .1.34.4.
Which attributes do I need?
IPsec Attributes in the IPsec attributes.
I have certain things, but I configure what part.
It's not Ike V1, it's Ike.
Then you specify local authentication is pre-shared.
And the key also you specify here.
Remote authentication is.
What?
Pike V two Remote authentication is also pre-shared key, and the key is.
So local and remote is both things you specify together.
That's it.
That's all you do here.
So your authentication type is also specified.
Your authentication key is also specified.
Dun dun group with the address is also specified.
Then the normal stuff crypto IPsec used to have a transform set.
Right.
There is no transform set anymore.
It's called Ikev2 IPsec proposal.
The name is changed.
Everyone else know everyone was normal.
Hi.
Everyone were here?
No.
On 8.4.
It's like that.
8.4.
We didn't do it yet.
We have to do it after this.
We do proposal, right?
Call it anything.
I'll call it tea set.
Then you specify the protocol.
It's a little different than IPCC transform set.
You specify the protocol.
Obviously you only use one protocol which is ESP H is not their encryption.
What?
What method are you using for encryption?
Three days you can specify more than one protocol esp also for authentication or integrity.
What are you using for integrity?
MD5 as a backup Sha.
Correct.
Specify both of them.
Then I have my transform set.
What else do I require?
Access list 101 Permit IP from ten 1111 .02552552550 Going to ten 440.
So I might transform set, which is the proposal.
I have my access list, I have my peer, I have my I have two properties.
The last thing that I would require is what crypto map.
I map.
Then again, this is IPsec.
No need.
I have set.
Not transform set, but.
Ikev2 IPsec proposal.
Crypto map I mapped and set here will be the same.
150 .1.34.4.
Crypto map i map ten match address will be the same crypto map i map interface outside crypto ikev2
enable outside not.
I enable outside ikev2.
Enable outside.
Okay.
Let me do this on the notepad quickly.
So I do all of that.
I do the I do the proposal after the proposal is what?
Tunnel Group 150 .1.34.4 Type IPsec L2 And then again the same thing.
But which properties?
IPsec.
Properties.
What properties are likely to local authentication is pre-shared and the key is.
Similarly for.
Remote authentication.
So you're doing two things.
You're killing two birds with one stone.
You're saying my authentication type is pre-shared.
You're also specifying the key.
So pre-shared key, remote and local is also.
Right.
Done.
What else did I do?
Crypto IPsec not transform set, but it's called IP to.
Proposal.
Episode.
I called it what he said.
Then you go into the sub configuration mode and you say protocol is ESP encryption.
Then I'm going to be using is three dash.
Protocol.
ESP integrity that I'm going to be using is EMD.
Access list.
101 permit IP coming from 1011 11.0.
1210 440.
Texas is also set.
Then the final one is crypto map.
Map then set here on 51 .34.4.
Crypto Map.
Map ten set.
Match.
Address 101 Crypto map.
Map ten set not transform set Ikev2 IPsec proposal to.
He said finally.
Crypto.
Interface.
Outside.
And finally, crypto.
Ike we to.
Enable.
And the outside.
This is from the side.
I didn't configure my other side yet.
I still have to do that.
I still have to do this part.
So let me just first copy this to our for.
Okay then crypto IPsec transform set key set esp three days esp MD5.
Access list 101 permit IP going from ten 440.
Going to ten, 11.
11, zero.
Crypto map.
Map.
IPsec Isakmp Set PIR 151 .3. ten Match Address 101.
Right.
What else?
That.
Transform setting apply to the interface interface.
I say one zero.
Crypto map.
Both sides are done right?
If you enable Wireshark so we can see the exchange.
Ten.
11.
11.1.
Source ten four.
Very good.
So crypto to.
I see.
Nothing is formed.
Let's check from R to R for.
So I beat out.
And food is here.
I have a default route.
Can I ping 150 .1. 40.
30 dot ten.
Again showed on section crypto.
Let's check if everything is all right here.
Proposal three.
Five Group two policy is prop keyring.
PR is RSA.
The Pre-shared key is Cisco.
Then I have remote authentication.
Pre-shared.
Pre-shared keyring is which is correct.
Mode is tunnel.
That is okay.
My peer is 30.10 from here is okay, let's do one thing.
Let's go here and try here.
RSA.
I'll say Pre-shared key local Cisco because from that side I'm also doing the same key, right?
I'm not using.
I'm using one for remote and one for local.
So I'll say the local pre-shared key remote should not make a difference, but just to try.
Ten, ten.
11.
11.1.
So stands for.
In the meantime, I should also have.
So the package is not leaving out for.
Problem would be in the access list here.
In the crypto map.
Oh yeah.
How did I forget that Crypto map?
iMap and IPsec Isakmp.
I forgot to attach.
What set it to profile.
Which was Ike.
Correct?
Correct.
This is okay right here.
Matches are happening, so now should be okay.
Goes to show crypto have to say.
I have negotiated on MD5.
I've negotiated on three days.
Right.
I'm using from both sides and I have 86,400 seconds just to check.
I'll go back and change this.
So we ensure that this does not make a difference.
Crypto.
I agree to hearing here.
Here any I say no Pre-shared key local.
Cisco.
No remote.
Cisco only Pre-shared key.
Let's see if it works.
Me to.
Send interesting traffic again.
Does not make a difference as long as it matches, as long as what you send matches there.
And what he send matches here.
To not make a difference to one side, you can use local and remote.
The other side you just use the symmetrical key as right.
Sending traffic through.
I can go.
I can also go to the other server.
Rachel.
Crypto IPsec.
I have traffic going through.
Even from the SSI Crypto.
Crypto.
App traffic going.
Same same concept.
So crypto to say will show you a little more details about who's the local guy, who's the remote guy,
your spy numbers sq.
You were the responder.
You didn't initiate the connection.
Someone else did.
You responded to it.
The port numbers that I'm using everything same.
No difference.
And the package.
Right?
Forgot the package.
Internet authors.
Initialize the connection and then authenticate the connection.
Correct.
Any questions would like me to.
It's the same thing before.
It's the same exact thing.
This is it.
The only one extra step was what?
Crypto.
Agree to policy ten.
Then I said encryption three days.
Integrity is MD5.
And finally.
That's it.
I figured this.
And from the other side, you already know how to do it.
Like we.
Difference comes here.
Tunnel group is used in all of your all of your VPNs Tunnel group.
You will always use to specify either the pre-shared key in this case.
In this case you don't specify the pre-shared key.
You do it local.
Is Cisco remote?
Is Cisco a little different, but the method is the same.
To specify the key, you will always use this easy VPN.
You use this web VPN, you use this, and now you're using it here.
To specify the key.
Right.
And if you have, let's say, a C server, you will point to the key server also using the tunnel group.
You could say local authentication is server RSA and remote is PSP.
But as I said last time, we won't usually do that.
Yes, to get you out of situations where you don't have any other option, you'll use it, but most
generally you will not.
Okay.
Then the other thing that changes is transform.
That is not transform set anymore.
It's called IPsec proposal.
So that's your proposal and the rest of the stuff is already the same.
Instead of saying set, transform, set, you set, set like we do proposal.
That's it.
Just remember Transform set is IPsec proposal now Ikev2 IPsec proposal.
The name is a little longer than it was before, but it does the same things.
Okay, last thing, quickly.
The easiest one is.
Isaac Ike V1.
So I'll go to R4 interface fast Ethernet one zero.
I'll say no crypto map.
I map no crypto map.
I map ten.
I'll remove the whole crypto map.
I'll remove no crypto.
IPsec transform set to set.
Like me to.
Profile.
Heating.
Right.
So basically everything.
Nothing is there on the assay.
It's even easier to remove.
How to configure Crypto.
Crypto.
Tunnel group.
Group policy.
That's it.
Clear.
All of it is clear.
So run.
You will not see any sign of crypto here anywhere.
Okay.
I do need my ACL, which is here.
I'll use that later.
ACL 101.
Let's do it from our for side crypto policy ten encryption three days authentication key Share hash
MD5 and group two Crypto Icecap key Cisco Address 150 .1.3. ten Crypto IPsec Transform Set Key Set.
As.
25.
Crypto.
Map.
I map ten.
IPsec Isocarp set here.
151 .3. ten Set Transform set to set match address one on one interface for one zero crypto map.
As the camp is on.
Does not support this.
Go to the crypto.
What do you choose?
From the options.
What do you use?
Ik one Ik v one.
What do you want right now?
Policy.
I'll call it ten.
Encryption.
He does authentication pre-shared hash, not integrity.
Hash integrity is part of IPV two hash MD5 and group two.
How do I specify the key?
Tunnel group.
Right?
Dental group.
The address is 151 .334.4.
And then type is IPsec L to L Tunnel Group.
150 .1.34.4.
IPsec Attributes.
How do I specify the key?
Have a look at the options.
Like we won earlier.
It was like we to authentication.
Now it's ikev2.
Pre-shared key is what?
I know.
Okay, then.
See?
I'll do it here.
This was what ik v2.
Ik v1 is like that if you compare the two crypto.
Ik v1 policy then when you say encryption three days.
Authentication.
Share.
Group.
Hash MD.
Then to specify the key is tunnel group.
Specify the address type.
IPsec L2 L.
Do the same thing again, but this time specify what?
IPsec Because this is where you specify the key every time.
Here how did you do it?
To local authentication and stuff like that.
On V1 you just say Ik v1 pre shared key is Cisco because you don't have the option of local and remote
and IP one.
It's only available to you in IP two.
Right.
8.4.
The other stuff.
What else do I need?
A transform set Crypto IPsec Who do I go to?
Ike again.
Same.
I mean, you just have to follow it.
Ike We won then.
It's not called an IPsec proposal here.
It's called a We know that.
It's called a transform set.
And you call it T set.
Then you specify ESP three days, ESP.
MD5.
Okay, access list is already created.
Then the last one is crypto map.
I map ten set here 151 .34.4.
Match Address 101 Crypto Map map ten Set transform Set.
I won't have transform set.
I have what I have one transform set.
The difference is transformed.
It becomes I one transformed set.
That's it.
Everything else is the same.
As before.
Right.
Finally, crypto map map interface outside crypto ikev1.
Enable outside not icecap ip.
Basecamp is out of the question.
Show access list just to see if I have the access list.
I do.
I'll go from R4 and pink.
10.11 point.
11.1 goes through show crypto campus to show crypto IPsec section caps traffic is getting encrypted
decrypted from RSA also show crypto IPsec section caps just.
Blue caps.
The traffic is going both direction, so R1 can also go.
I don't.
Is that R2?
R2 is also dead, but that's okay.
I can send traffic to them.
It is.
And it's the same thing.
Where's my.
Where's my wife?
Look at the packets that were exchanged.
One, two, three, four, five, six, seven, eight, nine.
Same.
Nothing changes at all.
The only thing that changes is what.
The implementation on the.
That's the only thing that changes.
They've made it better if you really think about this, because tunnel group will remain the same on
all of them where VPN and the process will be the same.
Once you learn one of them properly, the other ones become much easier once you understand the whole
concept of how it works.
And obviously you always have.
What.
We've been set up for a.
Right.
So which one do I want to set up?
For example, right now it's side to side steps.
The step four side to side.
Yeah, that's what I want to see.
Remote access is here.
L2 Remote access site to site SSL.
Remote access is also here.
Very nice.
SSL VPN.
This is for the.
Its enable SBC image AnyConnect.
Tunnel protocol is SBC and Web VPN.
I don't think.
Should I be able to choose to write?
But I don't see the option here.
With and side to side.
He shows me one.
This is the one which we did set up.
Safe to say.
Steps.
I see camp shows your normal camp.
It doesn't even show you that one.
I will not even work here.
It's showing guys again.
But yeah, that's what it feels.
But the thing is, even this one is not transform set anymore.
It's IP one transform set.
See the command will not be here.
Crypto Crypto IPsec Transform Set is not a command, it's Ike v1 Transform set.
So I think the the steps that he's showing you, I think they're outdated.
Maybe they have not updated the VPN setup yet because these steps are from the old 18.2.
These won't work.
8.28.4.
Maybe in this version, which I have, they have not, but I'm sure that they will.
Should be there.
8.6 probably they might have updated it.
Now you're using nine.
So obviously there should be there.
Clear.
You understand how this is done?
I cvv2 ikwe one.
That's all about VPNs.
If you want, you can do this.
Remember the VPN that we did?
You can do it with RSA.
Also, you can do it with RSA.
All you have to do is get a server here, authenticate and enroll the same way that you used to do before.
Crypto.
CA Then what price point, whatever CA that you create, right?
The commands are the same enrollment URL, you enroll it, then crypto CA authenticate CA and enroll.
Once you do that, then you can go to your tunnel group.
In your IPsec attributes, you can specify.
I've one.
Best point, not the pre-shared key, but the trust point pointed to the server, so it will use the
ECC to form the certificates.
Okay.
I'll say if you check my previous video, one of the videos in the series.
What I've done is because mostly VPN is not used with the Pre-shared key.
Most of the times it will be used with what RSA Certificates.
The clients have to get a certificate.
They have to.
There's a way of doing it.
By the.
You have to your VPN client, right?
You have to authenticate it with a CA server.
Get the key from there.
Then go to the to the.
It's very easy.
It's not really difficult.
It is in the video for properly documented.
Do that also for reference.
Do take the videos for flex vpn hub and spoke.
Flex vpn site site to site and flex VPN.
Spoke to spoke and remote access.
All three also from the previous series.
There are there.
You don't have time to do that right now, but do that.
Keep them with you.
You might need it in the future.
It's flex.
VPNs are replacing everything.
Next.
Why?
Because, again, same process of implementation.
You can do the same process of implementation.
You can add Dmvpn, easy VPN, get VPN all together so you want to migrate from one to another.
It's very easy with flex VPN.
Obviously when you create something scalable, the configuration is even more difficult, right?
Because obviously it's scalable, right?
Scalable means adding will be easy, but to configure it will be difficult, right?
Keep them because I know right now you won't go through with all those VPNs, right?
You have a lot to cover, obviously.
Let's do that.
But keep it with you.
You might need it.
I mean, not just.